Spring Framework Algorithmic Denial-of-Service Vulnerability via User-Supplied SpEL Expressions

A vulnerability exists in Spring Framework versions 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48, all of which are no longer supported. Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions can be exploited to cause an Algorithmic Denial-of-Service (DoS). By crafting a specific expression, an attacker can induce excessive resource consumption during the evaluation process, leading to application degradation or unavailability.

Impact

Exploitation of this vulnerability causes excessive resource consumption, leading to application degradation or unavailability.

Remediation

Users of affected versions should upgrade to the fixed version. The upgrade versions are: 7.0.8 (OSS) or 7.0.7.1 (Commercial), 6.2.19 (OSS) or 6.2.18.1 (Commercial), 6.1.28 (Commercial) and 5.3.49 (Commercial).